The Devs Accounting plugin for WordPress is vulnerable to unauthorized deletion of accounting records because the delete_single_account() function lacks a permission callback, exposing the REST route 'devs-accounting/v1/delete-account/(?P<id>\d+)' to unauthenticated GET requests. An attacker can issue a simple HTTP request with any account ID and cause the plugin to mark the corresponding entry in the wp of financial data, violating integrity and potentially impacting business reporting.

This flaw affects installations of the Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress up to and including version 1.2.0. WordPress sites that have not upgraded beyond 1.2.0 and rely on the plugin for managing accounting entries are vulnerable. The affected code resides in class-devs-accounting-accounts.php, where the delete route is registered without permission checks.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, so uncertainty exists about current exploitation frequency. The issue is not listed in the CISA KEV catalog, but the lack of authentication for a destructive operation makes it attractive to attackers. Because the endpoint is publicly reachable, an unauthenticated adversary can trigger the deletion remotely over the network without requiring any credentials.